ASA-201705-4 log original external raw

[ASA-201705-4] rpcbind: denial of service
Arch Linux Security Advisory ASA-201705-4 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : rpcbind Type : denial of service Remote : Yes Link : Summary ======= The package rpcbind before version 0.2.4-3 is vulnerable to denial of service. Resolution ========== Upgrade to 0.2.4-3. # pacman -Syu "rpcbind>=0.2.4-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ==========